MASTER DIGITAL DATA CREATION DEVICE AND 
DIGITAL DATA REPRODUCTION DEVICE 



5 BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

The present invention relates to a master digital data 
creation device and a digital data reproduction device, and 
10 more particularly to a master digital data creation device 
and a digital data reproduction device that prevent the illegal 
reproduction or copy of distributed digital data such as audio 
data and video data. 

15 2. Description of the Related Art 

Recently, more and more recording and reproduction 
devices and their media have become available for processing 
digital data. These devices and media give audio and video 
users many benefits such as high-speed, non-degraded recording 

20 and reliable reproduction. On the other hand, a problem has 
arisen that many non-degraded copies are produced quickly and 
sold with no permission from copyright holders . The 
prevention of illegal copy has become critical. 

To prevent illegal copy , theSCMS ( Serial Copy Management 

25 System) is used for conventional digital recording and 
reproduction devices such as a digital audio tape recorder 
(DAT) and a minidisk (MD) . IntheSCMS, copy permission status 
information is recorded in a particular area on a medium . That 
is, when the copy permission status information recorded on 

30 a copy source medium is "00", the same copy permission status 
information "00" is recorded also on a copy destination medium 
to permit the user to create another copy from the copy 
destination medium (so called copy free). 

When the copy permission status information recorded 

35 on a copy source medium is "10", the copy permission status 
information is changed to "11" on a copy destination medium 
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to inhibit the user from creating another copy from the copy 
destination medium {that is, copy is permitted only once). 
This system is established on the assumption that, upon 
detection of the copy permission status information of "11" 
5 on a medium, an SCMS- conforming device stops the copy 
operation . 

Other conventional copy prevention methods include 
digital data encryption. This is accomplished by scrambling 
copy-protecting digital data with the use of a predetermined 

10 control word and, at the same time, by encrypting the control 
word with particular key data. 

FIG.l shows the overview of an exemplary conventional 
copy protection method. In a mastering device 1 shown in the 
figure, a scrambler 2 scrambles digital data P, such as audio 

15 service (contents) data, using a control word P and outputs 
scrambled digital data C to a recording medium 4 . At the same 
time, an encryption unit 3 encrypts the control word P using 
key data K and outputs a control word C to the recording medium 
4. 

20 In a reproduction device 5 . a decryption unit 6 receives 

the control word C reproduced from the recording medium 4 and 
decrypts it to the control word P using the key data K. At 
the same time, in the reproduction device 5, a de-scrambler 
7 receives the digital data C reproduced from the recording 

25 medium 4 and produces the digital data P using the control 
word P already produced by the decryption unit 6 . Algorithms 
suitable for this processing include DES(Data Encryption 
Standard), RSA{ named after Ron Rives t, Adi Shamir, and Len 
Adleman). Vfhen data is copied from this recording medium 4 

30 to another recording medium, only the digital data C is copied, 
without the control word C. When reproducing data from the 
copy destination medium, de- scrambling processing cannot be 
performed correctly and therefore the user cannot receive 
services {Digital data P cannot be reproduced correctly) . In 

35 this way, the copy operation is virtually prevented. 

However, when the copy permission status information 
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is rewritten in the SCMS, that is. when the information is 
altered, the following problem arises . For example, once the 
copy permission status information on the copy source medium, 
even if "10", is rewritten to "00" either when it is copied 
5 to a copy destination medium or by a processor on a transmission 
line, data may be illegally copied thereafter. 

In addition, the conventional method for scrambling 
digital data in which all copies are prevented, the user is 
not permitted to create even a personal backup copy against 

10 an accidental destruction of a recording medium. This is 
unreasonable because the merit of using digital data is 
impaired. What is important is that copy operation should 
not be limited but that the copyright holder of digital contents 
should be paid for the service the user receives. This means 

15 that a copy management method other than that described above 
is required. 

In the prior art, a method is disclosed which solves 
this problem by charging the user for the reproduction of 
digital contents reproduction, calculating the total of the 
20 usage amount, and distributing the charge among copyright 
holders (Japanese Patent Laid-Open Publication No. Hei 
10-269289) . 

However, the conventional method and device, which 
return the digital contents usage status to a charge manager, 
25 require communication between the reproduction device and the 
charge manager and therefore makes processing complex. 

SUMMARY OF THE INVENTION 

30 In view of the foregoing, it is an object of the present 

invention to provide a master digital data creation device 
and a digital data reproduction device capable of preventing 
illegal copies with no need for communication between a 
reproduction device and a charge manager. 

3 5 To achieve the above object, there is provided a master 

digital data creation device comprising: an encryption block 
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generating a first control word based on a specified allowable 
number of reproductions and applying a one-way function to 
the first control word the allowable number of reproductions 
to generate a second control word; a scrambler receiving the 
5 second control word for scrambling desired first digital data 
using the second control word to produce second digital data; 
and an output block outputting the second digital data and 
the first control word to an external device. 

According to the present invention, digital data, as 

1 0 well as the control word including information on the allowable 
number of reproductions , may be recorded on the recording media 
Therefore , when reproducing the digital data , the number times 
data may be reproduced may be limited to the allowable number 
of reproductions . This simplifies accounting management and, 

15 at the same time, allows accounting processing for digital 
data copyright holders to be completed by charging the user 
for a user-desired predetermined number of reproductions the 
first time digital data is recorded on the recording media, 
thus eliminating the need for communication with the accounting 

20 manager for each reproduction. 

To achieve the above object , there is provided a digital 
data reproduction device comprising: an acceptor accepting 
recording media on which second digital data and a first control 
word CWk are recorded, the first control word being generated 

25 based on a specified allowable number of reproductions, the 
second digital data being generated by scrambling desired first 
digital data using a second control word CWo generated by 
applying a one-way function to the first control word CWk K 
times; a decryption block receiving the first control word 

30 CWk and applying the one-way function to the first control 
word CWk k times to produce the second control work CW©; a 
de- scrambler receiving the second digital data and the second 
control word CWo and de- scrambling the second digital data 
using the second control word CWo to produce the first digital 

35 data; and a reproduction unit reproducing the first digital 
data generated by the de -scrambler, wherein, after the 
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reproduction "by the reproduction unit, the decryption block 
writes a third control word CW(k-i) back to the recording media, 
the third control word being generated by applying the one-way 
function to the first control word CWk once, and wherein, if 
5 the first control word CWk received from the recording media 
equals the second control word CWo, the de- scrambling by the 
de- scrambler and the reproduction by the reproduction unit 
are inhibited. 

According to the present invention, when reproducing 

10 data from the recording media on which digital data and the 
control word including information on the allowable number 
of reproductions are recorded, the allowable number of 
reproductions may be decremented for each reproduction. 
Therefore, by inhibiting reproduction when the allowable 

15 number of times has reached 0, the number of times data may 
be reproduced may be limited to the allowable number of 
reproduction that is initially set. 

In a preferred embodiment of the present invention , when 
a desired number of reproductions, n, is received from some 

20 other reproduction device, the decryption block receives the 
first control word CWx from the recording media and, if k 
^n, applies the one-way function to the first control word 
CWk (k-n) times to produce the third control word CWn and applies 
the one-way function to the first control word CWk n times 

25 to produce the fourth control word CW{K-n); if k<n, produces 
the first control word CWk as the third control word CWn and 
produces the second control word CWo as the fourth control 
word CW(K-n) ; and records the fourth control word CW(k-ii) on the 
recording media for updating, further comprising: an output 

30 block outputting the second digital data recorded on the 
recording media, and the third control word CWn obtained from 
the decryption block, to the other reproduction device. 

In this embodiment, when the number of reproductions, 
n, is specified by some other reproduction device, the third 

35 control word CWn, as well as the second digital data, is output 
to the other reproduction device and, at the same time, the 
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first control word CWk is updated to CW(k-n) . Therefore . a part 
of the limited number of reproductions , k, is distributed from 
a reproduction device as a copy source to another reproduction 
device as a copy destination, connected to the copy source, 
5 through the copy operation. This makes it possible for the 
number of reproductions to be managed independently when 
digital data is reproduced at the reproduction device as a 
copy source and at the other reproduction device as a copy 
destination connected to the copy source. 
10 Therefore, the present invention allows digital data 

to be distributed without impairing the merits of digital 
processing such as high-speed, non- degraded recording and 
reliable reproduction and, at the same time, prevents illegal 
copy. 

15 The nature, principle and utility of the invention will 

become more apparent from the following detailed description 
when read in conjunction with the accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

20 

In the accompanying drawings : 

FIG.l is an overview of an example of a conventional 
copy prevention method. 

FIGS . 2A and 2B are a block diagram showing a digital 
25 data reproduction device in an embodiment according to the 
present invention and a configuration diagram of main 
components, respectively. 

FIG. 3 is a block diagram showing a master digital data 
creation device in the embodiment according to the present 
30 invention. 

FIGS . 4A and 4B are a diagram depicting an example of 
the encryption block shown in FIG. 3 and the format of a control 
word, respectively. 

35 DESCRIPTION OF THE PREFERRED EMBODIMENTS 
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An embodiment according to the present invention will 
be described belowwith reference to the accompanying drawings . 

FIG.2A is a block diagram of an embodiment of a digital 
data reproduction device according to the present invention, 
5 and FIG.2B is a diagram showing the configuration of the 
decryption block shown in FIG.2A. Before describing the 
digital data reproduction device in this embodiment, the 
following describes how digital data that is the source of 
all copies (that is, master digital data) is created in an 
10 illegal-copy prevention system according to the present 
invention . 

FIG. 3 is a block diagram of an embodiment of a master 
digital data creation device according to the present invention 
In the description below, master digital data is simply 

15 referred to as a master. Referring to FIG. 3 , amaster creation 
device 20 comprises a scrambler 21 scrambling digital data 
that is supplied to the user, an encryption block 2 2 encrypting 
a control word, and a communication block 23 communicating 
with user's reproduction device. The communication block 23 

20 is connectable to a reproduction device 25 via a transmission 
medium 24. 

Next, referring to FIG. 3, the master creation operation 
will be described . The master creation device 20 is installed , 
for example , in a store where video software and other software 

25 products are sold to the user. The user goes to the store 
and connects his or her own reproduction device 25 to the master 
creation device 20 via the transmission medium 24. The user 
specifies digital data corresponding to a desired service and 
the number of reproductions p. Although not shown in this 

30 figure, the user is charged for the number of reproductions 
p. Note that the charge also depends on the digital data type, 
contents and so on. 

The number of reproductions p is sent to the encryption 
block 22 via the transmission medium 24 and the communication 

35 block 23 in the master creation device 20. Although not 
required as input to the encryption block 22, key data K is 



also input to the encryption block 22 to fully protect 
copyrights . 

When the key data K is input to the encryption block 
22. it is required that the same key data K be set also in 
5 the reproduction device 25. The key data K may be used as 
input to a one-way function within the encryption block 22. 
The encryption block 22 outputs control word CWp that depends 
on the number of reproductions p and control word CWo that 
is input to the scrambler 21. The control word CWp is sent 

10 to the reproduction device 25 via the communication block 23 
and the transmission medium 24. 

The scrambler 21 uses the control word CWo to scramble 
digital data P selected according to the user's desire. 
Encryption algorittims such as the DES may be used for scrambling 

15 Digital data C, which is output from the scrambler 21 as a 
master, is sent to the reproduction device 25 via the 
communication block 23 and the transmission medium 24. The 
digital data C and the control word CWp are recorded on the 
recording medium in the reproduction device 25 . In this way, 

20 the user desired digital data P that is scrambled, as well 
as the control word CWp, is created in user's reproduction 
device 25 to produce a recording medium that may be reproduced 
the number of reproductions p. 

FIG.4A is an outline block diagram of an example of the 

25 encryption block 22 described above. This encryption block 
22 first generates a random value from a random value generator 
221 to perform replacement. Because the number of 
reproductions is 3 in the example in FIG.4A, a part of the 
random value is replaced with 3 according to the format of 

30 the control word CW shown in FIG.4B. The result is output 
as the control word CW3 . 

As shown in the format example in FIG.4B, the control 
word CW is composed of a random value 27 of a one-way function 
f and a replacement value 28. The replacement value 28 

35 indicates the number times the one-way function f is to be 
applied until the control word CWo is obtained. This is the 



number of times the one-way function is to be applied until 
the control word CWq is obtained which is used to indicate 
that the allowable number of reproductions has been exhausted 
in the master digital data reproduction device or that a control 
5 word necessary for digital data de-scrambling has been 
obtained. 

The control word CW3 described above is processed 
recursively by the one-way function f the number of 
reproductions . The one-way function f is defined as a function 

10 whose input is difficult to estimate from the output. The 
key data K, as well as the control word CW, is input to the 
one-way function f as necessary. The replacement operation 
is also performed for the output of the one-way function f 
in each stage and, when the part of the control word CW eventually 

15 becomes 0, the control word is output as CWq. This control 
word CWo is used by the scrambler 21. 

Next, returning to FIGS.2A and 2B, an embodiment of the 
digital data reproduction device will be described. As shown 
in FIG.2A, a reproduction device 10 is connected to another 

20 reproduction device 17 via a transmission medium 16. This 
reproduction device 10 corresponds to the reproduction device 
25 shown in FIG. 3- The reproduction device 10 comprises 
recording media 11a and lib, a decryption block 12, a 
de-scrambler 13. a reproduction unit 14, and a communication 

25 block 15. On the recording medium 11a, the data C sent from 
the master creation device 20 described above and generated 
by scrambling the user desired digital data P is recorded. 
On the recording medium lib, the control word CWp corresponding 
to the number of reproductions P is recorded. 

30 The de-scrambler 13 uses the control word CWq, sent from 

the decryption block 12, to de-scramble digital data from the 
recording medium 11a to produce digital data P. The 
reproduction unit 14 reproduces the received digital data P. 
The communication block 15 is provided for communication 

35 between the reproduction device 10 and the other reproduction 
device 17 via the transmission medium 16. 



As shown in the block diagram in FIG.2B, the decryption 
block 12 comprises a CWk register 121 in which the control 
word CWk read from the recording medium lib is temporarily 
stored, a CWn register 122 in which the control word to be 
5 output to the communication block 15 is temporarily stored, 
a CWo register 123 in which the control word CWo to be output 
to the de-scrambler 13 is temporarily stored, and a one-way 
function f replacement processor 124. The one-way function 
f replacement processor 124 receives the number of 

10 reproductions n from the reproduction device 17. 

Next, the operation of the embodiment shown in FIGS.2A 
and 2B will be described. The digital data C, such as audio 
service data scrambled by the master creation device 20 with 
the use of the control word CWo, is input to the reproduction 

15 device 10 for recording on the recording medium 11a. At the 
same time, the control word CWp corresponding to the number 
of reproductions p is input to the reproduction device 10 for 
recording on the recording medium lib. 

The control word CWp recorded on the recording medium 

20 lib is read into the decryption block 12, where the control 
word CWp is decrypted to the control word CWo using the same 
keyword K as that used by the master creation device 20. The 
control word CWo, in conjunction with the digital data C read 
from the recording medium 11a, is input to the de- scrambler 

25 13. The de-scrambler 13 de-scrambles the received digital 
data C using the decryption control word CWo and outputs the 
de-scrambled digital data P to the reproduction unit 14. 

The reproduction unit 14 decodes the encoded digital 
data P received from the de-scrambler 13 and outputs the decoded 

30 data to a device external to the reproduction device 10 for 
providing the service to users. After confirming that 
reproduction has been terminated, the decryption block 12 
writes the control word CW{p-i) back to the recording medium 
lib. 

35 Next, copying the digital data C from the recording 

medium 11a to a recording medium on another reproduction device 
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17 will be described. In this case, the other reproduction 
device 17 first informs the reproduction device 10 of the 
desired number of reproductions, n, via the communication block 
15. Assume that the control word currently recorded on the 
5 recording medium lib is CWr. The decryption block 12 reads 
this control word CWr from the recording medium lib and 
recursively performs the one-way function and replacement for 
this control word to output the control word CWn- 

The control word CWn output from the decryption block 

10 12, in conjunction with the digital data C read from the 
recording medium 11a, is supplied, via the communication block 
15 and the transmission medium 16, to the other reproduction 
device 17 for copying the data to its recording medium. After 
confirming that a copy is created successfully, the decryption 

15 block 12 updates the contents of the recording medium lib with 
the control word CWr' generated by recursively performing the 
one-way function and replacement for the control word CWk. 
Note that k' = k - n. That is, because a copy permitting n 
times of reproductions is made from the recording media 11a 

20 and lib. from which data may be copied up to k times, to the 
other reproduction device 17, the remaining number of 
reproductions of the recording media 11a and lib equals (k-n) 
times . 

Next, processing performed by the decryption block 12 
25 will be described more in detail. Assume that the control 
word recorded on the recording medium lib is CW5 (K=5) . That 
is, in the description below, it is assumed that digital data 
that may be reproduced up to five times will be copied once. 
In this case, the decryption block 12 reads the control word 
30 CW5 from the recording medium lib and temporarily stores it 
in the CWr register 121 in the decryption block 12. 

Next, the processor 124 performs the one-way function 
f and replacement for the control word CW5 in the CWr register 
121 once and stores the result in the CWr register 121 to update 
35 its contents. The one-way function f and replacement 
processing are the same as those performed by the encryption 
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block 2 2 shown in FIG. 4A. Thatis, the CWk register 121 contains 
CW4 at this time. 

After that, the processor 124 performs the one-way 
function f and replacement repeatedly and, when the result 
5 becomes CWo, stores this control word CWo in the CWo register 
123. Finally, the contents of the CWk register 121 are written 
back to the recording medium lib, and the contents of the CWo 
register 123 are output to the de-scrambler 13. 

Next , the following describes how digital data is copied 

10 when the control word recorded on the recording medium lib 
is CWs {k=5) , that is, when data may be reproduced up to five 
times , and the number of reproductions of 2 is specified ( n=2 ) . 
In this case, the decryption block 12 reads the control word 
CW5 from the recording medium lib and temporarily stores it 

15 in the CWr register 121 in the decryption block 12. 

Then, the processor 124 performs the one-way function 
f and replacement for the control word CW5, stored in the CWk 
register 121, (k - n) times to produce the control word CWn 
and stores it in the CWn register 122. When n = 2, the control 

20 word CW2 is stored in the CWn register 122. 

In addition, the processor 124 performs the one-way 
function f and replacement for the control word CW5, stored 
in the CWr register 121, n times to produce the control word 
CW(K-n) and stores it in the CW^ register 121 toupdate its contents 

25 When n = 2, the control word CW3 is stored in the CWk register 
121. Thatis, the remaining allowable number of reproductions 
is 3 (=5-2). 

After that, the processor 124 performs the one-way 
function f and replacement repeatedly and, when the result 
30 becomes CWo, stores this control word CWo in the CWo register 
123 . Finally, the control word CW2 stored in the CWn register 
122 is output to the communication block 15 and then the contents 
(CW3) of the CWk register 121 are written back to the recording 
medium lib. 

35 Next , the following describes how digital data is copied 

when the control word recorded on the recording medium lib 
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is CW5 (k=5) , that is, when data may be reproduced up to five 
times , and the number of reproductions of 6 is specified (n=6 ) . 
In this case, too, the decryption block 12 reads the control 
word CW5 from the recording medium lib and temporarily stores 
5 it in the CWr register 121 in the decryption block 12. 

In this case, because k-n = 5-6 = -1(^0) , the processor 
124 does not perform processing for the control word CW5, with 
the control word CW5 remained in the CWn register 122. 

In addition, because k-n = 5-6 = -1(^0) , the processor 
10 124 performs the one-way function f and replacement for the 
control word CW5, stored in the CWr register 121 , maximum times . 
namely, five times to produce the control word CWo and stores 
it in the CWr register 121 to updates its contents. That is, 
the remaining allowable number of reproductions becomes 0. 
15 The control word CWo is stored in the CWo register 123. 
: Finally, the control word CW5 stored in the CWn register 

122 is output to the communication block 15 and then the contents 
(CWo) of the CWk register 121 are written back to the recording 
Z medium lib. After that, when the recording media 11a and lib 

20 are reproduced, the control word CWo is reproduced from the 
£ recording medium lib and therefore the decryption block 12 

does not decode data and reproduction is not performed normally . 
As described above, even if the number of reproductions larger 
than the allowable number of reproductions is specified in 
25 this embodiment, only the allowable number of reproductions 
may be made and an attempt to create more copies than the 
allowable number of reproductions is prevented. 

It should be understood that many modifications and 
adaptations of the invention will become apparent to those 
30 skilled in the art and it is intended to encompass such obvious 
modifications and changes in the scope of the claims appended 
hereto . 
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